                 (e/grant-all-ingest (u/conn-context) "prov1guid")
                 (f))
               (fixtures/grant-all-group-fixture ["prov1guid"]))
+
+(def provider-acl-for-catalog-item
+  "A provider ACL that grants create to guest to facilitate catalog-item creation"
+  {:legacy_guid "ABCD-EFG-HIJK-LMNOP"
+   :group_permissions [{:group_id "REPLACEME"
+                        :permissions ["read" "update" "create" "delete"],}
+                       {:user_type "guest"
+                        :permissions ["read" "update" "create" "delete"]}]
+   :provider_identity {:provider_id "PROV1"
+                       :target "CATALOG_ITEM_ACL"}})
 
 (deftest invalid-params-test
   (are [params errors]

        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))
        update-acl #(ac/update-acl (u/conn-context) %1 %2 {:token token})
        get-collection-permissions #(get-permissions %1 coll1)
        get-granule-permissions #(get-permissions %1 gran1)]

    (testing "no permissions granted"
      (are [user permissions]

        coll1 (save-prov1-collection "coll1")
        gran1 (save-granule coll1)
        create-acl #(:concept_id (ac/create-acl (u/conn-context) % {:token token}))
        update-acl #(ac/update-acl (u/conn-context) %1 %2 {:token token})
        ;; required to create catalog item acl
        _ (create-acl (assoc-in provider-acl-for-catalog-item [:group_permissions 0 :group_id] created-group-concept-id))
        _ (u/wait-until-indexed)]

    (testing "no permissions granted"
      (are [user permissions]
